ZirSrSSKJr SSKrSSKrSSKrSSKrSSKrSSKrSSK r SSK J r SSK r SSK r \RR\RR!\RR#\555r\RR\RR)\S55r\\R;a\RR-S\5 SSKJr SSKJrJrJr SSKJr SS KJ r S r!S r"\RF\RH\RJ\RL\RN\RFS .r("S S\RR5r*\RNS-4Sjr+\+"S5r,Sr-\R\SS::aSr/OSr/\0r1Sr2Sr3Sr4\Rj"S5r6\6RnS:Xde\Rj"S5r8\8RnS:XdeSr9Sr:Sr;SrSr?/SQr@SrAS rBS!rCS"rDS#rES$rFS%rG"S&S'\H5rI"S(S)\H5rJS*rKS+\A4S,jrLS-rMS.rN"S/S0\ R5rPS8S1jrQS2rRS3rSS8S4jrTS5rUS8S6jrV\WS7:Xa\R"\V"55 gg)9a_ oleobj.py oleobj is a Python script and module to parse OLE objects and files stored into various MS Office file formats (doc, xls, ppt, docx, xlsx, pptx, etc) Author: Philippe Lagadec - http://www.decalage.info License: BSD, see source code or documentation oleobj is part of the python-oletools package: http://www.decalage.info/python/oletools )print_functionN) is_zipfile..)xglob)is_pptPptFilePptRecordExOleVbaActiveXAtom) XmlParser)ensure_stdout_handles_unicodez0.60.1warning)debuginfor errorcritical debug-olefilec\rSrSrSrSrSrg) NullHandlerza Log Handler without output, to avoid printing messages if logging is not configured by the main application. Python 2.7 has logging.NullHandler, but this is necessary for 2.6: see https://docs.python.org/2.6/library/logging.html section configuring-logging-for-a-library cgN)selfrecords i/var/www/eduai.edurigo.com/question_generate/ques_gen_env/lib/python3.13/site-packages/oletools/oleobj.pyemitNullHandler.emits rN)__name__ __module__ __qualname____firstlineno____doc__r__static_attributes__rrrrrzs  rrc(U[RRR;a)[R"U5nUR U5 U$[R"U5nUR [55 UR U5 U$)aR Create a suitable logger object for this module. The goal is not to change settings of the root logger, to avoid getting other modules' logs on the screen. If a logger exists with same name, reuse it. (Else it would have duplicate handlers and messages would be doubled.) The level is set to CRITICAL+1 by default, to avoid any logging. )loggingLoggermanager loggerDict getLoggersetLevel addHandlerr)namelevelloggers r get_loggerr0sr w~~%%000""4(   t $F km$ OOE MroleobjcJ[R[R5 g)z Enable logging for this module (disabled by default). This will set the module-specific logger level to NOTSET, which means the main application controls the actual logging level. N)logr+r&NOTSETrrrenable_loggingr5s LL rzJ{http://schemas.openxmlformats.org/package/2006/relationships}Relationshipz>{http://schemas.microsoft.com/office/2006/01/customui}customUIz>{http://schemas.microsoft.com/office/2009/07/customui}customUIz Read an unsigned integer from the first 32 bits of data. :param data: bytes string or stream containing the data to be extracted. :param index: index to start reading from or None if data is stream. :return: tuple (value, index) containing the read value (int), and the index to continue reading next time. r8r) STRUCT_UINT32unpackreaddataindexvalues r read_uint32rSa }$$TYYq\215 >$$Ta%89!<   >rcUc*[RURS55SnX!4$[RXUS-5SnUS- nX!4$)aG Read an unsigned integer from the 16 bits of data following index. :param data: bytes string or stream containing the data to be extracted. :param index: index to start reading from or None if data is stream :return: tuple (value, index) containing the read value (int), and the index to continue reading next time. r6r) STRUCT_UINT16rMrNrOs r read_uint16rWrTrc[X5up!US:XaSU4$Uc&URUS- 5nURS5nOXX-S- nXU-S- nX- nU[:XdeX14$)aU Read a length-prefixed ANSI string from data. :param data: bytes string or stream containing the data to be extracted. :param index: index in data where string size start or None if data is stream :return: tuple (value, index) containing the read value (bytes string), and the index to start reading from next time. rr$)rSrN NULL_CHAR)rPrQlength ansi_string null_chars rread_length_prefixed_stringr^s ,MF {E{ }iiq) IIaL a0 va(    !! !  rcSH:nURUSS9n[RSRX55 Us $ [R S5 URSSS9$![a Mpf=f)zguess encoding of byte string to create unicode Since this is used to decode path names from ole objects, prefer latin1 over utf* codecs if ascii is not enough )asciilatin1utf8z utf-16-leutf16strict)errorszdecoded using {0}: "{1}"zGfailed to guess encoding for string, falling back to ascii with replacer`replace)decoder3r format UnicodeErrorr )rPencodingresults rguess_encodingrl1s~ D [[([;F II188J KM DKK%& ;;wy; 11    s5A&& A43A4c4Uck[5n[[5HCn[UR S55nUS:Xa[ U5U4s $UR U5 ME [S5eURSX[-5n[ XU5US-4$)aC Read a zero-terminated string from data :param data: bytes string or stream containing an ansi string :param index: index at which the string should start or None if data is stream :return: tuple (unicode, index) containing the read string (unicode), and the index to start reading from next time. r$rz&found no string-terminating zero-byte!) bytearrayxrange STR_MAX_LENordrNrlappend ValueErrorrQ)rPrQrk_charend_idxs rread_zero_terminated_stringrxCs } $Atyy|$Dqy%f-u44 MM$  % ABB**We;->?d12GAI==rc0\rSrSrSrSrSrS SjrSrSr g) OleNativeStreami_z OLE object contained into an OLENativeStream structure. (see MS-OLEDS 2.3.6 OLENativeStream) Filename and paths are decoded to unicode. r$r6NcSUlSUlSUlSUlSUlSUlSUlSUlX lSUl SUl UbURUS9 gg)z Constructor for OleNativeStream. If bindata is provided, it will be parsed using the parse() method. :param bindata: forwarded to parse, see docu there :param package: bool, set to True when extracting from an OLE Package object N)rP) filenamesrc_path unknown_shortunknown_long_1unknown_long_2 temp_path actual_sizerPrBis_linkdata_is_streamparse)rbindatarBs r__init__OleNativeStream.__init__ksm  !""   "   JJGJ $ rc[US5(a SUlSnO SUlSnUR(dA[X5uUln[ R SRUR55 [X5uUl n[X5uUl n[X5uUl n[X5uUl n[X5uUln[X5uUln[X5uUlnUR(aXlOXX R -UlSUlg![&[(R*4a- [ R S5 SUlSUlSUlgf=f)a Parse binary data containing an OLENativeStream structure, to extract the OLE object it contains. (see MS-OLEDS 2.3.6 OLENativeStream) :param data: bytes array or stream, containing OLENativeStream structure containing an OLE object :return: None rNTNFrz*OLE native data size = {0:08X} ({0} bytes)z$data is not embedded but only a link)hasattrrrBrSnative_data_sizer3r rhrWr~rxr|r}rrrrrPrIOErrorstructrrrPrQs rrOleNativeStream.parsesN 4 "&D E"'D E||+6t+C (D !5 IIBvd334 6%0$<!E:4G u:4G u%0%="U%0%="U ;D H &1$&> #D e""  u-=-='=>  DL&  II< =DL D DI  s*AD22AE98E9) rrPrr|rrrBr}rrrr~NF rrr r!r" TYPE_LINKED TYPE_EMBEDDEDrrr#rrrrzrz_sKM%.0rrzc0\rSrSrSrSrSrS SjrSrSr g) OleObjectiz; OLE 1.0 Object see MS-OLEDS 2.2 OLE1.0 Format Structures r$r6NcSUlSUlSUlSUlSUlSUlSUlUbURU5 gg)a Constructor for OleObject. If bindata is provided, it will be parsed using the parse() method. :param bindata: bytes, OLE 1.0 Object structure containing OLE object Note: Code can easily by generalized to work with byte streams instead of arrays just like in OleNativeStream. N) ole_version format_id class_name topic_name item_namerP data_sizer)rrs rrOleObject.__init__sM     JJw  rc.Sn[X5uUln[X5uUln[R SURUR5 URUR UR 4;de[X5uUln[X5uUl n[X5uUl n[R SURURUR5 URUR :Xa[X5uUl n[R SUR[U5U- 5 XX R-Ul [UR5UR:XdeXUR-SUlgg)z Parse binary data containing an OLE 1.0 Object structure, to extract the OLE object it contains. (see MS-OLEDS 2.2 OLE1.0 Format Structures) :param data: bytes, OLE 1.0 Object structure containing an OLE object :return: rz!OLE version=%08X - Format ID=%08Xz,Class name=%r - Topic name=%r - Item name=%rz)Declared data size=%d - remaining size=%dN)rSrrr3r rrr^rrrrlenrP extra_datars rrOleObject.parsesR"-d":% +D 8 5""DNN 4~~$"4"4d6F6F!GGGG!>T// /%0$< !DNE IIAnnc$io 75#78DItyy>T^^3 33"#7#89DO 0r)rrPrrrrrrrrrrrrrsKM (!:rrcU(dU$[U5nX!:aU$URS5nUS:XaUSU$X#- nXA:aUSU$USX- XS-$)z@Create filename shorter than max_len, trying to preserve suffix..N)rrfind)fnamemax_lenname_lenidx suffix_lens rshorten_filenamersv  5zH ++c C byXgJXg $'$ %d 33rruc6[RRU5R5n[R "SX5n[ U5nSU;aURSS5nSU;aMSU;aURSS5nSU;aM[XB5$)a Return filename that is save to work with. Removes path components, replaces all non-whitelisted characters (so output is always a pure-ascii string), replaces '..' and ' ' and shortens to given max length, trying to preserve suffix. Might return empty string z[^a-zA-Z0-9._ -]rrz  ) ospathbasenamestripresubstrrfr)r| replacementrbasepath sane_fnames rsanitize_filenamersww)//1H+[CJZJ * ''c2  *  * ''c2  *  J 00rc ## /n/nXU4Hn[URS5URS55nXxS-SR5n[XsS9nU(dMTURS5nUS:XaUR U5 M~U[ U5S- :aUR U5 MUR XxS5 Uv M UHnUv M UR S 5 [ [5HXn UHOn U[ U 5- n U S:aMS R[R"S [S U 555n X-v MQ MZ S U-v g7f) a Get some sane filenames out of path information, preserving file suffix. Returns several canddiates, first with suffix, then without, then random with suffix and finally one last attempt ignoring max_len using arg `noname_index`. In some malware examples, filename (on which we relied sofar exclusively for this) is empty or " ", but src_path and tmp_path contain paths with proper file names. Try to extract filename from any of those. Preservation of suffix is especially important since that controls how windoze treats the file. /\r$NrrrrYabcdefghijklmnopqrstuvwxyzz oleobj_%03d) maxrrrrsrrangeMAX_FILENAME_ATTEMPTSjoinrandomsamplemin) r|r}tmp_pathr noname_indexsuffixescandidates_without_suffix candidaterrusuffix leftover_lenr-s rget_sane_embedded_filenamesr'sX H "(3 )//#& (=>!ef%++- &iA  ooc" "9 % , ,Y 7  3y>!# # % , ,Y 7   $(/44/ / OOB ( )F"S[0La776==)E),R)>@AD-  * , &&sEEc#l# Sn[U5nUR5Hn[UR55Hup4[ U[ 5(dMSn[ UR55nUS[[R5[R:waUcMlUR5 M~[RSRURU55 UR!5nUv UbUR5 MM M UbUR5 gg!["aE [R%SRUR55 [RSSS9 Nf=f!UbUR5 ff=f!UbUR5 ff=f7f)afind ole streams in ppt This may be a bit confusing: we get an ole file (or its name) as input and as output we produce possibly several ole files. This is because the data structure can be pretty nested: A ppt file has many streams that consist of records. Some of these records can contain data which contains data for another complete ole file (which we yield). This embedded ole file can have several streams, one of which can contain the actual embedded file we are looking for (caller will check for these). NzJFound record with embedded ole object in ppt (stream "{0}", record no {1})zCError reading data from {0} stream or interpreting it as OLE objectrYTexc_info)r iter_streams enumerate iter_records isinstancer nextiter_uncompressedrolefileMAGICcloser3r rhr-get_data_as_olefilerr )r|ppt_filestream record_idxrole data_starts rfind_ole_in_pptrfs{H8$++-F&/0C0C0E&F" f&BCCC(%)&*B*B*D%E %&9s7=='9:gmmK$?IIK #F#)6&++z#BD%88:! ?IIK+)'G.0   NN  #5 %D%+VFKK%8: "t 4 5 ?IIK+   NN  shF4AFFAD0$F)F;AD0>FF40A E?<F>E??FFFF11F4ct^\rSrSrSrU4SjrSrSrSrSr S Sjr \ R4S jr S rS rU=r$) FakeFileialcreate file-like object from data without copying it BytesIO is what I would like to use but it copies all the data. This class does not. On the downside: data can only be read and seeked, not written. Assume that given data is bytes (str in py2, bytes in py3). See also (and maybe can put into common file with): ppt_record_parser.IterStream, ooxml.ZipSubFile cd>[[U] 5 XlSUl[ U5Ulg)z&create FakeFile with given bytes data rN)superrrrPposrsize)rrP __class__s rrFakeFile.__init__s' h&( I rcgNTrrs rreadableFakeFile.readablercgrrrs rwritableFakeFile.writablesrcgrrrs rseekableFakeFile.seekablerrc[[U5URUR- 5nUS:XagURURURU-USU&U=RU- slU$)zread into pre-allocated target rN)rrrrrP)rtargetn_datas rreadintoFakeFile.readintos^S[$))DHH"45 Q;))DHHTXXf_=w F rcURUR:a [5$US:XaURUR- nURURURU-nU=RU- slU$)zread and return data r)rrbytesrP)rrrks rrN FakeFile.readsa 88tyy 7N R<YY)F488DHHVO4 F rc$U[R:XaUnObU[R:XaURU-nO>U[R:XaUR U-nO[ SRU55eUS:a [S5eX0lg)z!jump to another position in file z(invalid offset {0}, need SEEK_* constantrz%Seek beyond start of file not allowedN) ioSEEK_SETSEEK_CURrSEEK_ENDrrtrhr)rroffsetnew_poss rseek FakeFile.seeksx R[[ G r{{ "hhnG r{{ "ii#oGG$fVn. . Q;AB BrcUR$)z%tell where in file we are positioned )rrs rtell FakeFile.tells xxr)rPrr)r)rrr r!r"rrrrrrNrrrrr# __classcell__)rs@rrrs>  "{{ rrc#&# Ub#[RS5 Un[U5nO[RS5 UnUnSn[R"U5(at[ U5(a0[R SU-5 [U5H nUv SnM [R SU-5 [R"U5nUv GOGUc[U5(Ga Uc"[U5nUR5HnM [R SU-5 UR5HupvnUR[[R55n U [R:Xa]UR%S5 [R S U-5 [R"U5nUv UbUR-5 SnMM[RSU-5 M O)[R)SR+U55 Sv UbUR-5 gg![ a! [R#SU-5 Sv GM%f=f![&a; [R)S R+X55 [RS S S 9 Nf=f!UbUR-5 Snff=f![.a* [R#SR+U5S S 9 Sv Nf=f!UbUR-5 ff=f7f)ztry to open somehow as zip/ole/rtf/... ; yield None if fail If data is given, filename is (mostly) ignored. yields embedded ole streams in form of OleFileIO. Nz*working on data, file is not touched belowzworking on file by namez is ppt file: z is ole file: z is zip file: zzip is encrypted: rz unzipping ole: z@Error reading data from {0}/{1} or interpreting it as OLE objectrYTrz unzip skip: z5open failed: {0} (or its data) is neither zip nor OLEzCaught exception opening {0})r3r rr isOleFilerrr OleFileIOrr iter_xml iter_non_xmlrNrr RuntimeErrorrrrr rhr Exception) r|rP xml_parser arg_for_ole arg_for_ziprrusubfile file_handleheads rfind_olers  >? tn  +,  C:   [ ) )k""834*;7CIC8 HH_x/ 0##K0CI  #z+'>'>!&{3 #,,.A/ HH_x/ 0,6+B+B+D'K&++C ,>?D 7==($$Q'HH07:; '%// <! ?IIK"&C+IInw671,E4 KKO) +J ? IIK ?$II2X=>J#5 %D%+VH%>@ "t 4 5 ?IIK"&C+  077A  !  ? IIK sALB KK8A'K<(H0$=K"I<5K1K82(KK8L0&IKIKAJ# J&"J##J&&J>>K1K52K84K55K88LLc#(# URSS[5H\upnURSS:XaBURSRSS5SnU[;aX2RS4v MZM\M^ g![ [ 4a Mtf=f7f) zDiterate XML files looking for relationships to external objects NF TargetModeExternalTyperr$Target)rOOXML_RELATIONSHIP_TAGattribrsplitBLACKLISTED_RELATIONSHIP_TYPESAttributeErrorKeyError)rruelemrelationship_types rfind_external_relationshipsr&'s!))$7MN  {{<(J6$(KK$7$>$>sA$Fq$I!$(FF+[[-BBBG7O)   s)BAA;2 B;B BBBc## URSS[[45H upnURS5nUcMUv M" g7f)a\ iterate XML files looking for customUI to external objects or VBA macros Examples of malicious usage, to load an external document or trigger a VBA macro: https://www.trellix.com/en-us/about/newsroom/stories/threat-labs/prime-ministers-office-compromised.html https://www.netero1010-securitylab.com/evasion/execution-of-remote-vba-script-in-excel NFonLoad)rTAG_CUSTOMUI_2007TAG_CUSTOMUI_2010get)rrur$customui_onloads r find_customUIr-7sF!))$8IK\7]^ (+  %! !_s 6A Ac n [U[S- S9=(d SnU(ap[RR U5(d,[ R SU5 [R"U5 [RRX#5nO>[RRU5n[RRXS5n[S5 [SU-5 SnSnSnSn S n [U5(a[ R S 5 [U5n [U 5H=upS n [S U <S U <35 U RS5(dM2[S5 M? [U 5Hn S n [SU -5 M [!XU 5GHqn U cM U R#5GHSnSRU5n[ R%SU5 USR'5S:XdMDS nU R)U5n[SU-5 [S5 [+U5nUR2(a[ R%S5 M[SUR4-5 [SUR6-5 [SUR8-5 [;UR4UR6UR8[[=U5- S- U5H1nUS-U-n[RR?U5(aM1 O [SW-5 [AUS5nSn[C[DURF5nU(aURIU5nURKU5 U[=U5- n[=U5U:wa/[ R/S RMU[=U555 O&[C[DURFU- 5nU(aMS S S 5 S n UR15 US- nGMV GMt XxU 4$![,a/ [ R/S5 S nUbUR15 GMf=f!,(df  No=f![,a1n[ R/S!RMWU55 S nS nANS nAff=f!UR15 f=f)"aEfind embedded objects in given file if data is given (from xglob for encrypted zip files), then filename is not used for reading. If not (usual case), then data is read from filename on demand. If output_dir is given and does not exist, it is created. If it is not given, data is saved to same directory as the input file. rrNONAMEzcreating output directory %szO-------------------------------------------------------------------------------zFile: %rr$FNzJfile could be an OOXML file, looking for relationships with external linksTzFound relationship 'z' with external link zmhtml:z$Potential exploit for CVE-2021-40444zZFound customUI tag with external link or VBA macro %s (possibly exploiting CVE-2021-42292)rzChecking stream %rrz ole10nativez3extract file embedded in OLE object from stream %r:zParsing OLE Packagez*** Not an OLE 1.0 Objectz0Object is not embedded but only linked to - skipzFilename = "%s"zSource path = "%s"zTemp path = "%s"ruzsaving to file %swbrzWanted to read {0}, got {1}zerror dumping to {0} ({1}))'rMAX_FILENAME_LENGTHrrisdirr3rmkdirrdirnameprintrr r& startswithr-rlistdirr lower openstreamrzrr rrr|r}rrrisfileopenrDUMP_CHUNK_SIZErrNwriterh)r|rP output_dirr fname_prefixbase_dirrQ err_stream err_dumpingdid_dumpr relationshiprr path_parts stream_pathropkgembedded_fnamerwritern_dumped next_sizeexcs r process_filerMDs#85H5JKww}}Z(( HH3Z @ HHZ ww||J; 77??8,ww||H9  &M *x  EJKHJ( " #x( $? $K LH \SYZ [  **<= %L $J/FH nqww x0 3 ; ++-J((:.K II*K 8"~##%)::  ^^J7FO'()/0*62D<<II'((4==89+dmm;<)DNN:;&A t}}dnn+c*o=A5'JN)3.?E77>>%00 'J#-56eT*f#$$'9I9I$J '#);;y#9D"LL.$D 1H"4yI5 # ,I-3VIs4y-I!K %(+O,0,<,>( # #(()=)D)DX)NOO Orc [5 [S[-5 [S5 [S5 [S5 Sn[R"US9nUR SSS S S 9 UR S [ S SSS9 UR SSS[ SSS9 UR SSS[ SSS9 UR SSSS[SS 9 UR S!S[S"S#S$9 UR S%S&[ S"S'S(9 UR S)S*SS+S,9 URU5nUR(a U=RUR/- sl UR(aS-Ul UR(dUR5 [$[ R""[$UR[&R(S.S/9 [*R-[ R.5 URS0:Xa[0R2"5 S1nS1nS1n[4R6"URUR8UR:UR<S29HJupxn U(aUR?S35(aM%[AXURB5upn XJ-nX[-nXl-nML [Dn U(a U [F- n U(a U [H- n U(a U [J- n U $)4zmain function, called when running this as script Per default (cmd_line_args=None) uses sys.argv. For testing, however, can provide other arguments. z)oleobj %s - http://decalage.info/oletoolsz3THIS IS WORK IN PROGRESS - Check updates regularly!zGPlease report any issue at https://github.com/decalage2/oletools/issuesrYz4usage: %(prog)s [options] [filename2 ...])usagez-r store_true recursivez)find files recursively in subdirectories.)actiondesthelpz-dr>Nz(use specified directory to output files.)typerWdefaultrXz-zz--zip zip_passwordziif the file is a zip archive, open first file from it, using the provided password (requires Python 2.6+))rWrYrZrXz-fz --zipfname zip_fname*zoif the file is a zip archive, file(s) to be opened within the zip. Wildcards * and ? are supported. (default:*)z-lz --loglevelloglevelstorezElogging level debug/info/warning/error/critical (default=%(default)s))rWrVrZrXinputFILEz"Office files to parse (same as -i))nargsrYmetavarrXz-iz --more-inputz7Additional file to parse (same as positional arguments))rYrcrXz-vz --verbosez2verbose mode, set logging to DEBUG (overwrites -l))rVrXr z%(levelname)-8s %(message)s)r.rrhrF)rUr[r\r)&r r5 __version__rOArgumentParser add_argumentrDEFAULT_LOG_LEVELrQ parse_args more_inputr`verboser^ print_helpRETURN_ERR_ARGSr& basicConfig LOG_LEVELSsysstdoutr3r+r4rr5r iter_filesrUr[r\endswithrMr>RETURN_NO_DUMPRETURN_DID_DUMPRETURN_ERR_STREAMRETURN_ERR_DUMP) cmd_line_argsrSparseroptionsany_err_streamany_err_dumping any_did_dump containerr|rPrArBrC return_vals rmainrs"# 5 CD ?@  9: "I BE  $ $5 1F  \ HJ 3\4GI gN $,-  l3 #67  lG 156 sAC n3*+ k,/0 .G ',,// " ==  j)9)9:3::<>LL ?* NOL   W]]g6G6G*1*>*>'.'8'8 : " T **3//  );); < * $&  : Jo% '' o% r__main__r)Yr" __future__rr&rrOrrrorzipfilerrrrnormpathabspathr4__file___thismodule_dirr _parent_dirinsertoletools.thirdpartyroletools.ppt_record_parserrrr oletools.ooxmlr oletools.common.io_encodingr rdrgDEBUGINFOWARNINGERRORCRITICALrnHandlerrr0r3r5 version_inforZrrprr)r*StructrLrrVrqr<rsrtrlrurvr!r1rrSrWr^rlrxobjectrzrrrrr RawIOBaserrr&r-rMrQrrexitrrrrs T&   ''""277??277??83L#MNggrww||OTBC chhHHOOA{#%FF$E& (!--!,,!//!--!**&}} .   '//  #++A-8!A!II FeTT  d# Q d# Q "& "" 82$>8SfSlA:A:H4*-0112<'~(VAr||AHOd  "q-n`F zHHTVr